Spring Mvc整合Apache Shiro

Apache Shiro简介

Apache Shiro

Apache Shiro是一个强大易用的java安全框架，虽然不如Spring Security强大，但是对于大部分项目而言也够用了。而且在SSM/SSH中整合Spring Security都是比较麻烦的操作，所以在以上两个框架中使用shiro更多一点。

常用技术栈

• SSM+Shiro
• Spring Boot/Spring Cloud + Spring Security

整合Shiro

添加依赖

<dependency>  
    <groupId>org.apache.shiro</groupId>  
    <artifactId>shiro-core</artifactId>  
    <version>1.7.0</version>  
</dependency>  
<dependency>  
    <groupId>org.apache.shiro</groupId>  
    <artifactId>shiro-web</artifactId>  
    <version>1.7.0</version>  
</dependency>  
<dependency>  
    <groupId>org.apache.shiro</groupId>  
    <artifactId>shiro-ehcache</artifactId>  
    <version>1.7.0</version>  
</dependency>  
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring</artifactId>
    <version>1.7.0</version>
</dependency>

配置ShiroFilter(web.xml)

<filter>
    <description>shiro 权限拦截</description>
    <filter-name>shiroFilter</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    <init-param>
        <param-name>targetFilterLifecycle</param-name>
        <param-value>true</param-value>
    </init-param>
</filter>
<filter-mapping>
    <filter-name>shiroFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

新建shiro配置文件

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
                        http://www.springframework.org/schema/beans/spring-beans-3.1.xsd">

    <!-- 1.配置 Shiro 的 SecurityManager Bean. -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="cacheManager" ref="cacheManager"/>
        <property name="realm" ref="myRealm"/>
    </bean>
    
    <!-- 2.配置缓存管理器 -->
    <bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
	    <!-- 指定 ehcache 的配置文件 -->
	    <property name="cacheManagerConfigFile" value="classpath:ehcache-shiro.xml"/>
    </bean>
    
    <!-- 3.配置进行授权和认证的 Realm -->
    <bean id="myRealm" class="com.sqtg.shiro.ShiroRealm">
        <!--<property name="userService" ref="userService"/>-->
    </bean>
    
    <!-- 4.配置 Bean生命周期后置处理器: 会自动的调用和 Spring 整合后各个组件的生命周期方法. -->
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
    
    <!-- 5.启用ioc容器中使用shiro的注解， 但必须在配置了LifecycleBeanPostProcessor之后才可以使用 -->
    <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor">
    </bean>
    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
    	<property name="securityManager" ref="securityManager"></property>
    </bean>
    
    <!-- 
    	6.配置ShiroFilter
    	6.1 id必须和 web.xml文件中配置的DelegatingFilterProxy的filter-name一致
    	6.2
    -->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <!-- 装配 securityManager -->
        <property name="securityManager" ref="securityManager"/>
        <!-- 配置登陆页面 -->
        <property name="loginUrl" value="/login.jsp"/>
        <!-- 登陆成功后的页面 -->
        <property name="successUrl" value="/user.jsp"/>
        <!-- 没有权限的页面 -->
        <property name="unauthorizedUrl" value="/index.jsp"/>
        <!-- 
			配置哪些页面需要拦截，以及访问这些页面需要的权限
			1.anon 可以匿名访问
			2.authc 必须认证才可以访问
		  -->
        <property name="filterChainDefinitions">
            <value>
            	/swagger-ui.html=anon
                /swagger-resources/** = anon
                /v2/api-docs/** = anon
                /webjars/springfox-swagger-ui/** = anon
                
                /index.jsp=anon
                /login.jsp=anon
                /** = authc
            </value>
        </property>
    </bean>

</beans>

实现自定义Realm

package com.sqtg.shiro;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.realm.Realm;
//以下Realm只是最基本的可以让项目跑通，详细的请自行了解
public class ShiroRealm implements Realm{
	@Override
	public AuthenticationInfo getAuthenticationInfo(AuthenticationToken token) throws AuthenticationException{
		return null;
	}
	
	@Override
	public String getName() {
		return null;
	}
	
	@Override
	public boolean supports(AuthenticationToken arg0) {
		return false;
	}
}

以上就是配置shiro的全过程了，不出意外的话访问user.jsp将会自动跳转到login.jsp

可能会出现的问题

SSM整合Shiro出现no ContextLoaderListener registered的问题

Spring Mvc整合Apache Shiro

原文：https://www.cnblogs.com/bcxx/p/13975176.html